# AWS - API Gateway Unauthenticated Enum

{{#include ../../../../banners/hacktricks-training.md}}

### API Invoke bypass

Kulingana na hotuba [Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers - Alexandre & Leonardo](https://www.youtube.com/watch?v=bsPKk7WDOnE), Lambda Authorizers zinaweza kusanidiwa **using IAM syntax** ili kutoa ruhusa za kuita API endpoints. Hii inachukuliwa [**from the docs**](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html):
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Permission",
"Action": ["execute-api:Execution-operation"],
"Resource": [
"arn:aws:execute-api:region:account-id:api-id/stage/METHOD_HTTP_VERB/Resource-path"
]
}
]
}
```
Shida na njia hii ya kutoa ruhusa za kuita endpoints ni kwamba **"\*" inaashiria "chochote"** na **hakuna tena sintaksia ya regex inayotumika**.

Mifano kadhaa:

- Kanuni kama `arn:aws:execute-apis:sa-east-1:accid:api-id/prod/*/dashboard/*` ili kuwapa kila mtumiaji access kwa `/dashboard/user/{username}` itawapa pia access kwa routes nyingine kama `/admin/dashboard/createAdmin` kwa mfano.

> [!WARNING]
> Tambua kwamba **"\*" haizuizi kupanuka kwa kutumia slashi**, kwa hivyo, kama utatumia "\*" katika api-id kwa mfano, inaweza pia kuonyesha "any stage" au "any method" mradi tu regex ya mwisho bado ni halali.\
> Hivyo `arn:aws:execute-apis:sa-east-1:accid:*/prod/GET/dashboard/*`\
> Inaweza kuthibitisha post request kwa test stage kwa path `/prod/GET/dashboard/admin` kwa mfano.

Unapaswa kila mara kuwa wazi kuhusu unachotaka kuruhusu kufikia, kisha ukague ikiwa matukio mengine yanawezekana kwa ruhusa zilizotolewa.

Kwa taarifa zaidi, mbali na [**docs**](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html), unaweza kupata msimbo wa kutekeleza authorizers katika [**this official aws github**](https://github.com/awslabs/aws-apigateway-lambda-authorizer-blueprints/tree/master/blueprints).

### IAM Policy Injection

Katika [**talk** ](https://www.youtube.com/watch?v=bsPKk7WDOnE) imebainisha kwamba ikiwa code inatumia **user input** ku **generate the IAM policies**, wildcards (na mengine kama "." au specific strings) yanaweza kujumuishwa huko kwa lengo la **bypassing restrictions**.

### Kiolezo cha URL ya Umma
```
https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided}
```
### Pata Account ID kutoka URL ya umma ya API Gateway

Kama ilivyo kwa S3 buckets, Data Exchange na Lambda URL gateways, inawezekana kupata account ID ya akaunti kwa kutumia abusing wa **`aws:ResourceAccount`** **Policy Condition Key** kutoka URL ya umma ya API Gateway. Hii inafanywa kwa kupata account ID herufi moja baada ya nyingine kwa kutumia wildcards katika sehemu ya **`aws:ResourceAccount`** ya policy.\
Mbinu hii pia inaruhusu kupata **values of tags** ikiwa unajua tag key (kuna baadhi za default zenye kuvutia).

You can find more information in the [**original research**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) and the tool [**conditional-love**](https://github.com/plerionhq/conditional-love/) to automate this exploitation.

{{#include ../../../../banners/hacktricks-training.md}}